This invention relates to watchdog monitors, and more particularly to such monitors which independently test the microprocessor operation.
In FIG. 1, a computing or processing system 10 includes a microprocessor (xcexcP) 12 connected to a memory 14 by way of a local bus 16. The local bus is designed for very high operating speed in order to maximize the throughput of the computer. A north bridge 18 connects to local bus 16, and interfaces the local bus with a standard bus, such as a PCI bus 20. PCI bus 20 is coupled to a plurality of card sockets, designated 22a, 22b, . . . , 22N, which are adapted to accept industry-standard cards for interconnecting functions such as video and audio interfaces, printers, scanners, and the like. As mentioned, the computer system may also include nonstandard devices such as programmable timers, additional memory, interrupt controllers, and the like, which are typically mounted on the motherboard. These nonstandard devices are illustrated as blocks 28a, . . . , 28M, and are illustrated as being connected by way of a device bus 26 and a south bridge 24 to the PCI bus 20.
The system 10 of FIG. 1 also includes a frame timing source 30 which produces frame interrupt signals defining a frame interval on a frame interrupt bus 32 for application to microprocessor 12 and to a watchdog monitor (WDM) 34. Watchdog monitor 34 receives data, addresses, and device commands from device bus 26, frame interrupt signals by way of bus 32, and power turn-on reset (PTOR) signals from a source 36. The PTOR signals are also applied to microprocessor 12. The watchdog monitor 34 monitors the state of the system 10 and produces a watchdog monitor failure (WDMF) signal on an output bus 38 for further use.
FIG. 2 illustrates details of a prior-art watchdog monitor the computing or processing system of FIG. 1. The arrangement of FIG. 2 includes a retriggerable astable multivibrator 210 with a triggered duration which exceeds the time between interrupt pulses, and which generates an interrupt or frame failure fault flag on a bus 211 if the multivibrator ever resets to its stable state. This prior-art system also includes a further astable multivibrator 212 triggered by the interrupt pulses, which generates a signal on a line 213 which defines a time window. During this time window, a window detector 214 seeks a particular strobe at a particular watchdog monitor address. The microprocessor, in this prior-art system, is associated with interrupt-handling software which directs the generation of the particular strobe within the time window. Failure of the strobe to appear during the window is deemed to be a microprocessor failure. Thus, this prior art watchdog monitor monitors for both frame and microprocessor failure. Appearance of the strobe signal outside of the defined time window is deemed to be a fault.
The abovedescribed watchdog monitor simply determines if the microprocessor can service the monitor. However, the microprocessor may be able to service the monitor even if it is incapable of running the application software. For example, if the application software is caught in an infinite loop, the occurrence of the interrupt releases the microprocessor from the loop, and makes it available to service the monitor. However, when the microprocessor is returned from the interrupt handler to the application software, it is returned to the infinite loop, and performs no useful function. The prior-art monitor does not verify that the application software is exercising all of the tasks assigned during a frame. Systems using the prior-art watchdog monitor scheme use other tests to address the limitations of the watchdog monitor; these additional tests, however, involve software, so that the microprocessor is undesirable checking itself.
Improved watchdog monitors are desired.
A computing or processing system according to the invention comprises a microprocessor including a local bus port and at least one interrupt port. A local memory is coupled by way of a local bus to the local bus port of the microprocessor. A north bridge is coupled to the local bus port, for translating signals on the local bus to an industry-standard bus form. A south bridge is coupled to the industry-standard bus, for translating signals on the industry-standard bus to a device bus. A monitor arrangement is coupled to the device bus. The monitor arrangement includes (a) a clock independent of the system clock, for generating monitor clock signals, (b) a first missing-pulse detector coupled to the clock, for initiating counting at each monitor clock pulse, and for setting a clock failure flag if the count exceeds a threshold. The monitor arrangement further includes an ID validation machine adapted for receiving the monitor clock signals, device-level reset signals representative of initial turn-on of the monitor arrangement, data signals, device control signals, and microprocessor frame interrupt signals, for comparing at least one received microprocessor-generated predetermined word with a stored version of the word. This verifies that the microprocessor produces the correct word, and the north and south bridges properly translate the word. The ID validation machine sets an ID flag if the received and stored words differ, to thereby indicate a fault. The monitor arrangement further includes a second missing-pulse detector coupled to receive frame interrupt signals from the device bus, for initiating counting upon occurrence of each successive frame interrupt signal, and for setting a frame fault flag if the count exceeds a threshold. A gate is coupled to the first and second missing-pulse detectors, and to the ID validation machine, for generating a watchdog monitor fail signal if any one of the clock failure, ID, or frame fault flags is set. The computing or processing system according to the invention further includes means for causing the microprocessor to produce, during a frame following receipt of an interrupt signal at the interrupt port, at least the one predetermined word addressed to the monitor arrangement.